A packet transmitted through a network is captured and the captured packet is analyzed. For example, FIG. 1 illustrates a network to which three switches SW1, SW2, and SW3 are coupled. As illustrated in FIG. 1, servers A and B are coupled to the switch SW2, servers C and D are coupled to the switch SW3, and the switch SW1 is coupled to the switch SW2 and the switch SW3. In this case, the switch SW2 designates a port to which the server B is coupled as a target port of a mirroring in order to capture a packet generated when the server B communicates with the server A or the server C. Then, as illustrated by the dashed line, the switch SW2 causes a port coupled to an analysis device to output a copied packet. Similarly, the switch SW3 designates a port to which the server C is coupled as a target port of mirroring in order to capture a packet generated when the server C communicates with the server B or the server D. Then, as illustrated by the dashed line, the switch SW3 causes a port connected to the analysis device to output a copied packet.
Thus, a packet that is transmitted and received between the server A and the server B and a packet transmitted and received between the server B and the server C are transmitted from the switch SW2 to the analysis device. A packet that is transmitted and received between the server B and the server C and a packet that is transmitted and received between the server C and the server D are transmitted from the switch SW3 to the analysis device. In this case, the packets transmitted and received between the server B and the server C overlap one another, and therefore, an extra packet is discarded in the analysis device.
Conventionally, focus has been put on such discard of an extra packet. However, no other special measure has been taken than the basic processing of discarding one of the same packets which is received later. Specifically, the capacity of a memory used for discarding an extra packet becomes a problem as the number of packets that are to be captured increases. However, a technique in which reduction in capacity of a memory is examined has not yet been disclosed. It is preferable that the capacity of a memory used for removing a duplicate packet of packet captured from a communication device may be reduced.
Related art is described, for example, in Japanese Laid-open Patent Publication No. 2006-246195 and Japanese Laid-open Patent Publication No. 2009-207099.